Worm.Sower是一個可以通過多種方式傳播的蠕蟲病毒。該病毒的主要危害是結束大量反病毒軟體，降低系統的安全等級。
基本介紹
- 中文名：索爾
- 外文名：Worm.Sower
- 威脅級別：★★
- 病毒類型：蠕蟲
- 詞語分類：計算機用語
- 影響系統：Win 9x/ME,Win 2000/NT等
危害,附屬檔案名,
危害
1，生成檔案
%system%\RAVMOND.exe
%system%\IEXPLORE.EXE
%system%\kernel66.dll
%system%\msjdbc11.dll
%system%\MSSIGN30.DLL
%windows%\SYSTRA.EXE
2，添加啟動項
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
"run" = "RAVMOND.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"VFW Encoder/Decoder Settings" = "RUNDLL32.EXE MSSIGN30.DLL ondll_reg"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\runServices
"SystemTra" = "%windows%\SYSTRA.EXE"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\_reg
"ImagePath" = "Rundll32.exe msjdbc11.dll ondll_server"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"Program In Windows" = "%system%\IEXPLORE.EXE"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Management Protocol v.0 (experimental)
"ImagePath" = "Rundll32.exe msjdbc11.dll ondll_server"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"Protected Storage" = "RUNDLL32.EXE MSSIGN30.DLL ondll_reg"
3，結束含有下列字元串的進程
RISING
SKYNET
SYMANTEC
MCAFEE
GATE
RFW.EXE
RAVMON.EXE
KILL
NAV
DUBA
KAV
KV
4，通過可移動磁碟傳播
隨機檔案名稱
PassWord
email
book
letter
bak
WORK
Important
TEST 666
TEST
exe_start
Anti_virus_v99
隨機後綴名
.ZIP
.RAR
.scr
.pif
.com
.exe
command.exe
autorun.inf
autorun.inf內容
[AUTORUN]
Open="%c:\COMMAND.EXE"
5，通過p2p檔案共享軟體傳播
拷貝下列病毒檔案到已分享資料夾
Thank you.doc.exe
3D Flash Animator.rar.bat
SWF Browser2.93.txt.exe
Download.exe
Panda Crack.zip.exe
WinRAR V3.2.0 Beta 2.exe
Swish2.00.pif
AAdobe Photoshop7.0 creak.pif
You_Life.JPG.pif
CloneCD crack.exe
WinZip v9.0 Beta Build 5480 crack.exe
Real-DRAW PRO v3.10.exe
Star Wars Downloader.exe
HyperSnap-DX v5.20.01.exe
Adobe Photoshop6.0.zip.exe
HyperSnap-DX v4.51.01.exe
6，通過弱口令攻擊傳播
系統弱帳號及弱口令如下：
Guest
Administrator
zxcv
yxcv
xxx
xp
win
test123
test
temp123
temp
sybase
super
sex
secret
pwd
pw123
pw
pc
Password
owner
oracle
mypc123
mypc
mypass123
mypass
love
login
Login
Internet
home
godblessyou
god
enable
database
computer
alpha
admin123
Admin
abcd
aaa
a
88888888
2600
2003
2002
123asd
123abc
123456789
1234567
123123
121212
12
11111111
110
007
00000000
000000
0
pass
54321
12345
password
passwd
server
sql
!@#$%^&*
!@#$%^&
!@#$%^
!@#$%
asdfgh
asdf
!@#$
1234
111
1
root
abc123
12345678
abcdefg
abcdef
abc
888888
666666
111111
admin
administrator
guest
654321
123456
321
123
7，郵件傳播
郵件內容：
If you can keep your head when all about you
Are losing theirs and blaming it on you;
If you can trust yourself when all men doubt you,
But make allowance for their doubting too;
If you can wait and not be tired by waiting,
Or, being lied about,don't deal in lies,
Or, being hated, don't give way to hating,
And yet don't look too good, nor talk too wise;
... ... more look to the attachment.
附屬檔案名
the hardcore game-.pif
Sex in Office.rm.scr
Deutsch BloodPatch!.exe
s3msong.MP3.pif
Me_nude.AVI.pif
How to Crack all gamez.exe
Macromedia Flash.scr
SETUP.EXE
Shakira.zip.exe
dreamweaver MX (crack).exe
StarWars2 - CloneAttack.rm.scr
Industry Giant II.exe
DSL Modem Uncapper.rar.exe
joke.pif
Britney spears nude.exe.txt.exe
I am For u.doc.exe
